Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2024, 01:26

General

  • Target

    9ddb57dbaa9ec550fabc594a17740fbf3da778e781080fa2022d9f98bf0f4a33N.exe

  • Size

    80KB

  • MD5

    21ed8f7089aa6636b4ed176347b05890

  • SHA1

    f493a7f0db1d499b54842ba47852b7c6006b4d83

  • SHA256

    9ddb57dbaa9ec550fabc594a17740fbf3da778e781080fa2022d9f98bf0f4a33

  • SHA512

    e4184e9b54f62056b51c551b5b5fec7c0f4e4a5ff5fa410344fbf172e4b9d80506a16b9e609b280f81183c4f08ab7650dc2f778fe4e2e3a21cd1997301b4135d

  • SSDEEP

    1536:QPvK/3zvzVJJicVLhilofshajzJxuOmb54vHTL+lf:Qi5ikFSofPzVmb5uHv+lf

Score
10/10

Malware Config

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ddb57dbaa9ec550fabc594a17740fbf3da778e781080fa2022d9f98bf0f4a33N.exe
    "C:\Users\Admin\AppData\Local\Temp\9ddb57dbaa9ec550fabc594a17740fbf3da778e781080fa2022d9f98bf0f4a33N.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfcgi5vf.c55.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2624-74-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-71-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-3-0x000000001C270000-0x000000001C73E000-memory.dmp

    Filesize

    4.8MB

  • memory/2624-4-0x000000001C7E0000-0x000000001C87C000-memory.dmp

    Filesize

    624KB

  • memory/2624-5-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-6-0x0000000001460000-0x0000000001468000-memory.dmp

    Filesize

    32KB

  • memory/2624-7-0x000000001C940000-0x000000001C98C000-memory.dmp

    Filesize

    304KB

  • memory/2624-8-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-9-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-10-0x000000001DB20000-0x000000001DB82000-memory.dmp

    Filesize

    392KB

  • memory/2624-11-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-12-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-13-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-15-0x00007FFE0B3E5000-0x00007FFE0B3E6000-memory.dmp

    Filesize

    4KB

  • memory/2624-14-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-17-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-16-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-18-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-22-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-94-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-52-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-93-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-92-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-91-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-25-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-53-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-36-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-35-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-37-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-38-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-39-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-42-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-43-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-44-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-46-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-45-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-48-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-47-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-50-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-49-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-21-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-69-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-1-0x000000001BCF0000-0x000000001BD96000-memory.dmp

    Filesize

    664KB

  • memory/2624-55-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-54-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-57-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-56-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-58-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-59-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-60-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-61-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-62-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-64-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-63-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-66-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-65-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-68-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-67-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-70-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-51-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-72-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-2-0x00007FFE0B130000-0x00007FFE0BAD1000-memory.dmp

    Filesize

    9.6MB

  • memory/2624-0-0x00007FFE0B3E5000-0x00007FFE0B3E6000-memory.dmp

    Filesize

    4KB

  • memory/2624-73-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-75-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-76-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-78-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-77-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-80-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-79-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-82-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-81-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-84-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-83-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-85-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-86-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-87-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/2624-88-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-89-0x0000000020790000-0x0000000020890000-memory.dmp

    Filesize

    1024KB

  • memory/2624-90-0x00000000015D0000-0x00000000015E0000-memory.dmp

    Filesize

    64KB

  • memory/3276-19-0x0000017B584C0000-0x0000017B584D0000-memory.dmp

    Filesize

    64KB

  • memory/3276-20-0x0000017B584C0000-0x0000017B584D0000-memory.dmp

    Filesize

    64KB

  • memory/3276-24-0x0000017B70B50000-0x0000017B70B72000-memory.dmp

    Filesize

    136KB

  • memory/3276-23-0x00007FFE07A13000-0x00007FFE07A15000-memory.dmp

    Filesize

    8KB